Skip to main content
Deep
Deep
Visitor III
November 13, 2024
Question

Threat Intel Management - Enable TAXII Server

  • November 13, 2024
  • 3 replies
  • 2311 views

Hello,

 

I have enabled TAXII Server via Threat Intel Management and configured the TAXII on my FortiGate devices too. The Malicious entries are being synced to FortiGate configurations however facing few issues and need help on below: 

 

1- We had a requirement to add additional picklist types for filehashes i.e. Vhash, SSDEEP, Authentihash for blocking. And added the values too in TIM. It got synced to FortiGate however shows invalid entries unlike other valid entries for Filehash MD5, SHA1. Please guide what is missing here.

 

2-For some FortiGate devices, Threat intel feeds are replicated to some FortiGate devices and are not replicated on some. Please guide what can be the issue and any logs or troubleshooting steps for the same.

3 replies

sahirrao
Staff
sahirrao
Staff
November 14, 2024

@Deep We need to troubleshoot the FortiGate to understand how the feeds are being consumed and mapped. We also need to replicate the same scenario in our lab. Please give us some time to do this.

sahirrao
Staff
sahirrao
Staff
November 27, 2024

Apologies for the delayed response.

1. **RCA:**: According to the STIX indicator specification, valid hash types include MD5, SHA-1, SHA-256, and SHA-512. STIX does not support VHash, SSDEEP, or Authentihash. Please map the VHash, SSDEEP, and Authentihash hashes to the appropriate hash types supported by the STIX specification.
 
2. **RCA:** The failure may be due to the following two reasons:
1. Please verify whether the STIX indicator type fields being used in the firewall are present.
2. Each STIX indicator object requires the `pattern`, `pattern_type`, and `valid_from` properties, which are not being provided by the integration and could be causing the failure. Could you clarify which FortiSOAR integration feeds you are attempting to block in the firewall?
Deep
DeepAuthor
Visitor III
December 12, 2024

Appreciate your reply @sahirrao .

1-Can you please guide on which hash types are they when you say "Please map the VHash, SSDEEP, and Authentihash hashes to the appropriate hash types supported by the STIX specification"

2-The usual IOCs - IP, Domain, etc.

 

sahirrao
Staff
sahirrao
Staff
December 28, 2024

1. VHash, SSDEEP, and Authentihash are not supported by STIX. You can use STIX to represent file hashes with MD5, SHA-1, and SHA-256

2. For IP, Domain STIX indicator object requires the `pattern`, `pattern_type`, and `valid_from` properties. Please check these property are present in STIX objects.

 

Terms & ConditionsAccessibility statement